Prerequisite

• Ensure the server is running to use the dconf utility.

Procedure

• To monitor the server performance using the command-line, run:

  # dsconf -D "cn=Directory Manager" ldap://server.example.com monitor server

  where:

  • D is the bindDN argument to connect to the LDAP directory.
  • cn=Directory Manager is the bindDN value for LDAP authentication.
  • ldap collects the server statistics using the specified Lightweight Directory Access Protocol (LDAP) URL.

Procedure

• To run a health check, enter:

  # dsctl instance_name healthcheck
  Beginning lint report, this could take a while ...
  Checking Backends ...
  Checking Config ...
  Checking Encryption ...
  Checking FSChecks ...
  Checking ReferentialIntegrityPlugin ...
  Checking MonitorDiskSpace ...
  Checking Replica ...
  Checking Changelog ...
  Checking NssSsl ...
  Healthcheck complete.
  1 Issue found!  Generating report ...

  To display the output in JSON format, pass the --json parameter to the command:

  # dsctl --json instance_name healthcheck

  Example 2.1. Possible report of the health check

  [1] DS Lint Error: DSELE0001
  --------------------------------------------------------------------------------
  Severity: MEDIUM
  Affects:
   -- cn=encryption,cn=config
  
  Details:
  -----------
  This Directory Server may not be using strong TLS protocol versions. TLS1.0 is known to
  have a number of issues with the protocol. Please see:
  
  https://tools.ietf.org/html/rfc7457
  
  It is advised you set this value to the maximum possible.
  
  Resolution:
  -----------
  There are two options for setting the TLS minimum version allowed.  You,
  can set "sslVersionMin" in "cn=encryption,cn=config" to a version greater than "TLS1.0"
  You can also use 'dsconf' to set this value.  Here is an example:
  
      # dsconf slapd-instance_name security set --tls-protocol-min=TLS1.2
  
  You must restart the Directory Server for this change to take effect.
  
  Or, you can set the system wide crypto policy to FUTURE which will use a higher TLS
  minimum version, but doing this affects the entire system:
  
      # update-crypto-policies --set FUTURE
  
  
  ===== End Of Report (1 Issue found) =====

  Example 2.2. Possible report of the health check in JSON format

  [
      {
          "dsle": "DSELE0001",
          "severity": "MEDIUM",
          "items": [
              "cn=encryption,cn=config"
          ],
          "detail": "This Directory Server may not be using strong TLS protocol versions. TLS1.0 is known to\nhave a number of issues with the protocol. Please see:\n\nhttps://tools.ietf.org/html/rfc7457\n\nIt is advised you set this value to the maximum possible.",
          "fix": "There are two options for setting the TLS minimum version allowed.  You,\ncan set \"sslVersionMin\" in \"cn=encryption,cn=config\" to a version greater than \"TLS1.0\"\nYou can also use 'dsconf' to set this value.  Here is an example:\n\n    # dsconf slapd-instance_name security set --tls-protocol-min=TLS1.2\n\nYou must restart the Directory Server for this change to take effect.\n\nOr, you can set the system wide crypto policy to FUTURE which will use a higher TLS\nminimum version, but doing this affects the entire system:\n\n    # update-crypto-policies --set FUTURE"
      }
  ]

Prerequisites

• You enabled access logging.

• nsslapd-accesslog-compress (access log)
• nsslapd-errorlog-compress (error log)
• nsslapd-auditlog-compress (audit log)
• nsslapd-auditfaillog-compress (audit fail log)
• nsslapd-securitylog-compress (security log)

Procedure

• To enable log file compression, run:

  # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-accesslog-compress=on nsslapd-errorlog-compress=on

  The command enables compression for access and error logs.

• To disable log file compression, run:

  # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-accesslog-compress=off

  The command disables compression for the access log.

Verification

• Check that the log file directory contains compressed logs files:

  # ls /var/log/dirsrv/slapd-instance_name/

Procedure

• To disable high-resolution log time stamps in the command line, enter the following command:

Verification

• Verify that new log records have second precision. For example, open the access log file with the command:

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.

Procedure

• To view a replication topology report, enter:

  # dsconf -D "cn=Directory Manager" ldap://supplier.example.com replication monitor

  The dsconf utility will request authentication credentials for each instance in the topology:

  Enter password for cn=Directory Manager on ldap://supplier.example.com: password
  Enter a bind DN for consumer.example.com:389: cn=Directory Manager
  Enter a password for cn=Directory Manager on consumer.example.com:389: password
  
  Supplier: server.example.com:389
  --------------------------------
  Replica Root: dc=example,dc=com
  Replica ID: 1
  Replica Status: Online
  Max CSN: 5e3acb77001d00010000
  
  Status For Agreement: "example-agreement" (consumer.example.com:1389)
  Replica Enabled: on
  Update In Progress: FALSE
  Last Update Start: 20211209122116Z
  Last Update End: 20211209122116Z
  Number Of Changes Sent: 1:21/0
  Number Of Changes Skipped: None
  Last Update Status: Error (0) Replica acquired successfully: Incremental update succeeded
  Last Init Start: 20211209122111Z
  Last Init End: 20211209122114Z
  Last Init Status: Error (0) Total update succeeded
  Reap Active: 0
  Replication Status: In Synchronization
  Replication Lag Time: 00:00:00
  
  Supplier: consumer.example.com:1389
  -----------------------------------
  Replica Root: dc=example,dc=com
  Replica ID: 65535
  Replica Status: Online
  Max CSN: 00000000000000000000

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.

Verification

• Run the dsconf replication monitor command to see If dsconf utility uses credentials configured in the ~/.dsrc file. For more information, see

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.

• Define the aliases in the ~/.dsrc file:

  [repl-monitor-aliases]
  M1 = server1.example.com:389
  M2 = server2.example.com:389

• Define the aliases by passing the -a alias=host_name:port parameter to the dsconf replication monitor command:

  # dsconf -D "cn=Directory Manager" ldap://server.example.com replication monitor -a M1=server1.example.com:389 M2=server2.example.com:389

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.
• You are logged in to the web console.

Prerequisites

• The host is a member of replication topology.
• You initialized the consumer.
• You are logged in to the web console.

Prerequisites

• The host is a member of replication topology.
• You initialized the consumers.
• You are logged in to the web console.

Verification

• Generate the replication topology report to see If the report uses new aliases. For more information, see

Procedure

• Set the nsslapd-plugin-binddn-tracking parameter to on:

  # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-plugin-binddn-tracking=on

Verification

• Display the modifiersname and internalModifiersname attributes of an entry that was changed by a plug-in. For example, if the memberOf attribute is enabled, display the attributes of a user after you added the user to a group:

Prerequisites

• You are logged in to the Directory Server instance in the web console.

Verification

• Display the modifiersname and internalModifiersname attributes of an entry that was changed by a plug-in. For example, if the memberOf attribute is enabled, display the attributes of a user after you added the user to a group:

Procedure

• To display the current activity of a database, enter:

  # dsconf -D "cn=Directory Manager" ldap://server.example.com monitor backend userRoot

  This command displays the activity of the userRoot database.

• -S: specifies the time to begin the log file analysis.
• -E: specifies the time to stop the log files analysis.
• -bc: generates a report based on the number of DNs used to connect to the server and the total connection codes the server returns.
• -m: generates output data per second (-m) to a specified CSV output file.
• -M: generates output data with counts per minute (-M) to a specified CSV output file.

Procedure

• To generate a simple access log summary, run the following command:

  # logconv.pl /var/log/dirsrv/slapd-instance_name/access
  
  Access Log Analyzer 8.2
  Command: logconv.pl /var/log/dirsrv/slapd-instance_name/access
  Processing 1 Access Log(s)...
  
  [001] /var/log/dirsrv/slapd-instance_name/access size(bytes):77532
  
  Total Log Lines Analysed:  527
  Start of Logs:    14/Oct/2017:16:15:22.452909568
  End of Logs:      14/Oct/2017:16:39:50.157790196
  
  Processed Log Time:  0 Hours, 24 Minutes, 27.704877056 Seconds
  
  Restarts:                     10
  Secure Protocol Versions:
   - TLS1.2 client bound as uid=user_name,ou=people,o=example.com (11 connections)
   - TLS1.2 128-bit AES; client CN=CA Subsystem,O=example.com; issuer CN=Certificate Authority,O=example.com (11 connections)
   - TLS1.2 128-bit AES-GCM (2 connections)
   - TLS1.2 128-bit AES (3 connections)
  
  Peak Concurrent Connections:  38
  Total Operations:             4771
  Total Results:                4653
  Overall Performance:          97.5%
  
  Total Connections:            249          (0.17/sec)  (10.18/min)
   - LDAP Connections:          107          (0.07/sec)  (4.37/min)
   - LDAPI Connections:         128          (0.09/sec)  (5.23/min)
   - LDAPS Connections:         14           (0.01/sec)  (0.57/min)
   - StartTLS Extended Ops:     2            (0.00/sec)  (0.08/min)
  
  Searches:                     2963         (2.02/sec)  (121.13/min)
  Modifications:                649          (0.44/sec)  (26.53/min)
  Adds:                         785          (0.53/sec)  (32.09/min)
  Deletes:                      10           (0.01/sec)  (0.41/min)
  Mod RDNs:                     6            (0.00/sec)  (0.25/min)
  Compares:                     0            (0.00/sec)  (0.00/min)
  Binds:                        324          (0.22/sec)  (13.25/min)
  
  Proxied Auth Operations:      0
  Persistent Searches:          17
  Internal Operations:          0
  Entry Operations:             0
  Extended Operations:          4
  Abandoned Requests:           0
  Smart Referrals Received:     0
  
  VLV Operations:               30
  VLV Unindexed Searches:       0
  VLV Unindexed Components:     20
  SORT Operations:              22
  
  Entire Search Base Queries:   12
  Paged Searches:               2
  Unindexed Searches:           0
  Unindexed Components:         149
  
  FDs Taken:                    249
  FDs Returned:                 212
  Highest FD Taken:             107
  
  Broken Pipes:                 0
  Connections Reset By Peer:    0
  Resource Unavailable:         0
  Max BER Size Exceeded:        0
  
  Binds:                        324
  Unbinds:                      155
  ---------------------------------
   - LDAP v2 Binds:             41
   - LDAP v3 Binds:             180
   - AUTOBINDs(LDAPI):          103
   - SSL Client Binds:          0
   - Failed SSL Client Binds:   0
   - SASL Binds:                134
     - EXTERNAL: 114
     - GSSAPI: 20
   - Directory Manager Binds:   10
   - Anonymous Binds:           1
  
  Cleaning up temp files...
  Done.

  The logconv.pl script prints a list of total operations, total number of connections, counts per each operation type, counts for some extended operations like persistent searches, and bind information.

  • Optional: If you must enable additional connection summaries passed as a single option, such as the number of DNs used to connect to the server (b) and the total connection codes the server (c) returns, specify the -bc option as follows:

    # lotgconv.pl -bc /var/log/dirsrv/slapd-instance_name/access
    
    ----- Total Connection Codes -----
    U1              3    Cleanly Closed Connections
    B1              1    Bad Ber Tag Encountered
    
    ----- Top 20 Bind DN's -----
    Number of Unique Bind DN's: 212
    1801            cn=Directory Manager
    1297            Anonymous Binds
    311              uid=jsmith,ou=people...
    87               uid=bjensen,ou=peopl...
    85               uid=mreynolds,ou=peo...
    69               uid=jrockford,ou=peo...
    55               uid=sspencer,ou=peop...

  • Optional: If you must enable data output for a certain start (-S) and end time (-E) or within a specific range, run the following command

    # logconv.pl -S "[01/Jul/2022:16:11:47.000000000 -0400]" -E "[01/Jul/2022:17:23:08.999999999 -0400]" /var/log/dirsrv/slapd-instance_name/access
    ...
    ----------- Access Log Output ------------
    
    Start of Logs:    01/Jul/2022:16:11:47
    End of Logs:      01/Jul/2022:17:23:08

    When start and end times are set, the logconv.pl command first prints the time range given, then the summary for that period.

  • Optional: If you must enable data output with counts per minute (-M) or per second (-m), run the following command:

    # logconv.pl -m|-M outputFile accessLogFile